Millions of AMD CPUs found vulnerable to 18-year-old 'Sinkclose' deep-system flaw but it's pretty difficult to exploit

Security researchers have discovered a vulnerability that affects almost all AMD CPUs, allowing access to some of the deepest parts of the chip. Named 'Sinkclose', the flaw allows attackers that already have kernel-level access to modify SMM (System Management Mode) settings even with existing protections enabled.

Attackers could use the flaw to install malware that would be virtually undetectable, and extremely difficult to remove. However, gaining kernel access in the first place is no easy task, and AMD has already begun releasing fixes for some of the affected chips (via Bleeping Computer). 

The vulnerability was discovered by researchers Enrique Nissim and Krzysztof Okupski, two researchers from security services firm IOActive, who presented their findings at this year's Def Con security conference in Las Vegas over the weekend. 

Exploiting the flaw would require attackers to first establish kernel access on a target machine via a different attack method. This level of system access is defined as a Ring 0 privilege and essentially opens up the heart of the system to further attack. If successful, an attacker could then enable Ring -2 privileges to install an undetectable bootkit that compromises the master boot record, meaning that even an OS reinstall would be unable to remove it.

System Management Mode (SMM) is one of the deepest operating modes of an x86 architecture chip and is intended to be used by the BIOS/UEFI for power management, system hardware control and some proprietary OEM-designed code. Once compromised, no antivirus or anti-malware program would be able to detect malicious code running this deep in the heart of the system. To detect it, a user would have to physically connect to the CPU to scan the memory for malware.

AMD has released an advisory notice detailing chips vulnerable to the attack, along with firmware fixes that are being provided to OEMs for BIOS updates to fix the flaw. However, Ryzen 3000, 2000 and 1000 series chips will not